p PatchFirst

CVE-2024-37054

CVE-2024-37054

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.9.0 or newer, enabling a maliciously uploaded PyFunc model to run arbitrary code on an end user’s system when interacted with.

CVSS 8.8 · High · EPSS 0.7% · Public exploit

Published
Updated

Stack: python

Affected products and versions

  • mlflow

    Versions
    • ≥ 0.9.0: Affected (semver)

    No fix published

  • mlflow PyPI

    Versions
    • 0.9.0
    • 0.9.0.1
    • 0.9.1
    • 1.0.0
    • 1.1.0
    • 1.1.1.dev0
    • 1.10.0
    • 1.11.0
    • 1.12.0
    • 1.12.1
    • 1.13
    • 1.13.1
    • 1.14.0
    • 1.14.1
    • 1.15.0
    • 1.16.0
    • 1.17.0
    • 1.18.0
    • 1.19.0
    • 1.2.0
    • 1.20.0
    • 1.20.1
    • 1.20.2
    • 1.21.0
    • 1.22.0
    • 1.23.0
    • 1.23.1
    • 1.24.0
    • 1.25.0
    • 1.25.1
    • 1.26.0
    • 1.26.1
    • 1.27.0
    • 1.28.0
    • 1.29.0
    • 1.3.0
    • 1.30.0
    • 1.30.1
    • 1.4.0
    • 1.5.0
    • 1.6.0
    • 1.7.0
    • 1.7.1
    • 1.7.2
    • 1.8.0
    • 1.9.0
    • 1.9.1
    • 2.0.0
    • 2.0.0rc0
    • 2.0.1
    • 2.1.0
    • 2.1.1
    • 2.10.0
    • 2.10.1
    • 2.10.2
    • 2.11.0
    • 2.11.1
    • 2.11.2
    • 2.11.3
    • 2.11.4
    • 2.12.0
    • 2.12.1
    • 2.12.2
    • 2.13.0
    • 2.13.1
    • 2.13.2
    • 2.14.0
    • 2.14.0rc0
    • 2.14.1
    • 2.2.0
    • 2.2.1
    • 2.2.2
    • 2.3.0
    • 2.3.1
    • 2.3.2
    • 2.4.0
    • 2.4.1
    • 2.4.2
    • 2.5.0
    • 2.6.0
    • 2.7.0
    • 2.7.1
    • 2.8.0
    • 2.8.1
    • 2.9.0
    • 2.9.1
    • 2.9.2
    Affected ranges
    • ECOSYSTEM: ≥ 0.9.0, ≤ 2.14.1

    No fix published

Original sources

Check your server →